Urgent Alert: Critical PHP Vulnerability Threatens Website Security

PHP, a popular programming language for creating websites and web applications, has recently rolled out security patches to address two severe vulnerabilities. These vulnerabilities, rated at 9.2 out of 10 in severity, have the potential to cause significant damage if left unattended. Cybersecurity experts are advising website owners to apply the patches immediately or consider taking their systems offline temporarily.

The security patches were officially released at 10 AM ET today, urging PHP users to update their systems promptly. According to reports from cybersecurity firm watchTowr, the vulnerabilities are Remote Code Execution exploits affecting PHP versions from PHP 5 onwards. These exploits could allow attackers to execute malicious code on servers, potentially leading to website tampering and data theft.

The impact of these vulnerabilities is widespread, with an estimated 1.3 million internet-connected hosts at risk. WordPress sites, which account for over 40% of the internet, are also vulnerable as they run on PHP servers. Site owners are advised to manually apply the patches as automatic updates are not available for this fix.

Both the European Union Computer Emergency Response Team and the UK National Cyber Security Centre have issued warnings, suggesting companies isolate or take their internet-facing apps offline if immediate patching is not possible. Mobile OS developer GrapheneOS has already taken preemptive measures by temporarily shutting down their user forum due to emerging exploits. Gina Peter Banyard, a PHP developer, emphasizes that patching is crucial, and shutting down servers may be necessary in extreme cases.

Multiple cybersecurity organizations are advising PHP admins to prepare for potential mass attacks following the patch release. Cloudflare’s CTO, Dane Knecht, has reported early attacks targeting PHP sites and temporary firewall rule updates by Cloudflare to mitigate the risks.

Update, October 21st: The security patches have now been officially released.